ASP.NET Session Cookies - specifying the base domain

asp.net, cookies, session

Solution

Create a ISessionIDManager, since you only want to change the cookie domain we will let the default one do all the work.

This is configured in web.config on the sessionState element under `<system.web>`.

<sessionState sessionIDManagerType="MySessionIDManager" />

And the implementation.

public class MySessionIDManager: SessionIDManager, ISessionIDManager
{   
    void ISessionIDManager.SaveSessionID( HttpContext context, string id, out bool redirected, out bool cookieAdded )
    {
        base.SaveSessionID( context, id, out redirected, out cookieAdded );

        if (cookieAdded) {
            var name = "ASP.NET_SessionId";
            var cookie = context.Response.Cookies[ name ];
            cookie.Domain = "example.com";
        }
    }
}

Problem

By default, ASP.NET will set its cookies to use "mydomain.com" as their base. I'd prefer to have them use "www.mydomain.com" instead, so that I can have other "sub.mydomain.com" subdomains that are cookie-free. I've done some digging into the Session and Cookie objects, and while I can find how to set the domain for a single cookie, I don't see a way to set it for all Session cookies. Anybody ideas?

Original source